Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
90 IOCs
Keeping up with the Infostealers
Malware Families
Excerpt
Had many cases of infostealer incidents lately so I decided to research the latest infra to update my understanding of the malicious infrastructure landscape. TL;DR Full IoC list 1337team Limited Hypothesis Expanding on our previous post , our starting point for this hunt is the IP 185.215.113[.]16 and the hypothesis that a threat actor associated with various infostealers has been using AS51381 (1337team Limited) to deploy malicious infra. Starting on Censys from host…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →90 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 187.201.135.232 | High | Score 58/100 | First seen |
| IP | 189.134.97.255 | High | Score 58/100 | First seen |
| IP | 123.140.161.243 | High | Score 58/100 | First seen |
| IP | 187.156.38.229 | High | Score 58/100 | First seen |
| IP | 187.134.41.207 | High | Score 58/100 | First seen |
| IP | 187.156.151.152 | High | Score 58/100 | First seen |
| IP | 211.119.84.112 | High | Score 58/100 | First seen |
| IP | 189.189.229.237 | High | Score 58/100 | First seen |
| IP | 211.168.53.110 | High | Score 58/100 | First seen |
| IP | 189.181.30.147 | High | Score 58/100 | First seen |
| IP | 211.171.233.126 | High | Score 58/100 | First seen |
| IP | 187.156.64.85 | High | Score 58/100 | First seen |
| IP | 201.110.217.30 | High | Score 58/100 | First seen |
| IP | 189.163.98.139 | High | Score 58/100 | First seen |
| IP | 187.144.133.47 | High | Score 58/100 | First seen |
| IP | 201.119.104.185 | High | Score 58/100 | First seen |
| IP | 201.103.66.91 | High | Score 58/100 | First seen |
| IP | 187.205.255.67 | High | Score 58/100 | First seen |
| IP | 220.125.3.190 | High | Score 58/100 | First seen |
| Domain | niksplus.ru | High | Score 58/100 | First seen |
| IP | 187.211.34.223 | High | Score 58/100 | First seen |
| IP | 189.181.53.56 | High | Score 58/100 | First seen |
| IP | 187.156.113.114 | High | Score 58/100 | First seen |
| IP | 211.181.24.132 | High | Score 58/100 | First seen |
| IP | 201.119.33.19 | High | Score 58/100 | First seen |
| IP | 119.194.160.37 | High | Score 58/100 | First seen |
| IP | 218.152.239.116 | High | Score 58/100 | First seen |
| IP | 187.140.17.135 | High | Score 58/100 | First seen |
| IP | 187.201.173.202 | High | Score 58/100 | First seen |
| IP | 211.171.233.129 | High | Score 58/100 | First seen |
| IP | 211.202.224.10 | High | Score 58/100 | First seen |
| IP | 185.215.113.16 | High | Score 58/100 | First seen |
| IP | 189.181.23.186 | High | Score 58/100 | First seen |
| IP | 187.134.40.51 | High | Score 58/100 | First seen |
| IP | 211.104.254.139 | High | Score 58/100 | First seen |
| IP | 189.190.189.17 | High | Score 58/100 | First seen |
| IP | 201.103.179.216 | High | Score 58/100 | First seen |
| IP | 218.152.239.123 | High | Score 58/100 | First seen |
| IP | 58.151.148.90 | High | Score 58/100 | First seen |
| IP | 210.180.252.110 | High | Score 58/100 | First seen |
| IP | 187.134.42.142 | High | Score 58/100 | First seen |
| IP | 187.134.57.31 | High | Score 58/100 | First seen |
| IP | 201.124.243.137 | High | Score 58/100 | First seen |
| IP | 123.212.43.225 | High | Score 58/100 | First seen |
| IP | 187.211.202.16 | High | Score 58/100 | First seen |
| IP | 187.201.7.156 | High | Score 58/100 | First seen |
| IP | 189.141.147.36 | High | Score 58/100 | First seen |
| IP | 189.245.27.132 | High | Score 58/100 | First seen |
| IP | 189.179.37.132 | High | Score 58/100 | First seen |
| IP | 187.225.144.248 | High | Score 58/100 | First seen |
| IP | 211.59.14.90 | High | Score 58/100 | First seen |
| IP | 187.228.55.117 | High | Score 58/100 | First seen |
| IP | 187.201.114.50 | High | Score 58/100 | First seen |
| IP | 125.7.253.10 | High | Score 58/100 | First seen |
| IP | 189.232.1.60 | High | Score 58/100 | First seen |
| IP | 201.124.224.61 | High | Score 58/100 | First seen |
| IP | 211.181.24.133 | High | Score 58/100 | First seen |
| IP | 187.204.206.7 | High | Score 58/100 | First seen |
| IP | 189.163.178.96 | High | Score 58/100 | First seen |
| IP | 187.199.194.16 | High | Score 58/100 | First seen |
| IP | 187.204.55.0 | High | Score 58/100 | First seen |
| IP | 201.124.5.27 | High | Score 58/100 | First seen |
| IP | 201.110.241.248 | High | Score 58/100 | First seen |
| IP | 189.165.166.147 | High | Score 58/100 | First seen |
| IP | 189.161.121.167 | High | Score 58/100 | First seen |
| IP | 201.110.232.122 | High | Score 58/100 | First seen |
| IP | 189.165.174.71 | High | Score 58/100 | First seen |
| IP | 189.163.10.121 | High | Score 58/100 | First seen |
| IP | 187.204.66.156 | High | Score 58/100 | First seen |
| IP | 187.199.191.176 | High | Score 58/100 | First seen |
| IP | 211.119.84.111 | High | Score 58/100 | First seen |
| IP | 210.182.29.70 | High | Score 58/100 | First seen |
| IP | 187.204.80.208 | High | Score 58/100 | First seen |
| IP | 187.199.183.102 | High | Score 58/100 | First seen |
| IP | 187.199.187.63 | High | Score 58/100 | First seen |
| IP | 210.108.43.192 | High | Score 58/100 | First seen |
| IP | 187.156.82.96 | High | Score 58/100 | First seen |
| IP | 187.224.115.16 | High | Score 58/100 | First seen |
| IP | 187.152.17.215 | High | Score 58/100 | First seen |
| SHA256 | 00173630900838da2ccce0ae7fb54f7d8b3138434f63d056c636e0aec4f8e37b | Medium | Score 53/100 | First seen |
| IP | 189.189.172.68 | High | Score 58/100 | First seen |
| IP | 189.232.12.90 | High | Score 58/100 | First seen |
| IP | 119.204.11.2 | High | Score 58/100 | First seen |
| IP | 189.163.142.13 | High | Score 58/100 | First seen |
| IP | 175.119.10.231 | High | Score 58/100 | First seen |
| IP | 187.134.80.172 | High | Score 58/100 | First seen |
| IP | 187.204.100.230 | High | Score 58/100 | First seen |
| IP | 187.156.79.158 | High | Score 58/100 | First seen |
| IP | 189.169.23.66 | High | Score 58/100 | First seen |
| IP | 187.201.131.196 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…